> ==== > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include <unistd.h> > #include <sys/syscall.h> > #include <string.h> > #include <stdint.h> > #include <pthread.h> > > long r[6]; > > int main() > { > memset(r, -1, sizeof(r)); > r[0] = syscall(SYS_mmap, 0x20000000ul, 0x13000ul, 0x3ul, 0x32ul, > 0xfffffffffffffffful, 0x0ul); > memcpy((void*)0x2000eedb, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8); > r[2] = syscall(SYS_open, 0x2000eedbul, 0x0ul, 0x100ul, 0, 0, 0); > r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0); > r[4] = syscall(SYS_ioctl, r[3], 0xae41ul, 0x7ul, 0, 0, 0); > r[5] = syscall(SYS_ioctl, r[4], 0x8040ae9ful, 0x20010feful, 0, 0, 0); > return 0; > } > ==== > > strace: > > open("/dev/kvm", O_RDONLY) = 3 > ioctl(3, KVM_CREATE_VM, 0) = 4 > ioctl(4, KVM_CREATE_VCPU, 0x7) = 5 > ioctl(5, KVM_GET_PIT2 or KVM_GET_VCPU_EVENTS, 0x20010fef) = 0 > > Should be run in parallel (try increasing 10 to 100 or so, if this doesn't > work) > > $ for x in `seq 1 10`; do { ./prog & }; done
Here's a very similar one, but it works *inside* qemu, with nested virtualization enabled (AMD SVM). It hits another symbol in the kernel, but the general idea is the same. Run this binary ~100 times in parallel. Tested with host: 4.4 and guest 4.4 and 4.5-rc4 on host CPU Opteron 6272 ================= // autogenerated by syzkaller (http://github.com/google/syzkaller) #include <unistd.h> #include <sys/syscall.h> #include <string.h> #include <stdint.h> #include <pthread.h> #ifndef SYS_mmap #define SYS_mmap 9 #endif #ifndef SYS_syz_open_dev #define SYS_syz_open_dev 1000001 #endif #ifndef SYS_ioctl #define SYS_ioctl 16 #endif long r[6]; int main() { memset(r, -1, sizeof(r)); r[0] = syscall(SYS_mmap, 0x20000000ul, 0xf000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x2000173f, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8); r[2] = syscall(SYS_open, 0x2000173ful, 0x0ul, 0x100ul, 0, 0, 0); r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0); r[4] = syscall(SYS_ioctl, r[3], 0xae41ul, 0x8ul, 0, 0, 0); r[5] = syscall(SYS_ioctl, r[4], 0x8004ae98ul, 0x20007000ul, 0, 0, 0); return 0; } ================= strace: open("/dev/kvm", O_RDONLY) = 3 ioctl(3, KVM_CREATE_VM, 0) = 4 ioctl(4, KVM_CREATE_VCPU, 0x8) = 5 ioctl(5, KVM_GET_MP_STATE, 0x20007000) = 0 Run as: for x in `seq 1 40`; do { ./prog & }; done [ 162.697592] kvm: Nested Virtualization enabled [ 218.733272] BUG: unable to handle kernel NULL pointer dereference at 00000000000000f0 [ 218.733309] IP: [<ffffffffa025e34a>] kvm_apic_accept_events+0x2a/0x150 [kvm] [ 218.733312] PGD d4a1067 PUD f7b8067 PMD 0 [ 218.733314] Oops: 0000 [#1] SMP [ 218.733325] Modules linked in: kvm_amd kvm ext4 crc16 mbcache jbd2 sg sr_mod cdrom sd_mod ata_generic uhci_hcd ehci_hcd ata_piix usbcore e1000 libata usb_common scsi_mod floppy [ 218.733328] CPU: 1 PID: 2106 Comm: y Not tainted 4.3.0-0.bpo.1-amd64 #1 Debian 4.3.3-7~bpo8+1 [ 218.733329] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 218.733330] task: ffff88001f97e3c0 ti: ffff88001f9c8000 task.ti: ffff88001f9c8000 [ 218.733351] RIP: 0010:[<ffffffffa025e34a>] [<ffffffffa025e34a>] kvm_apic_accept_events+0x2a/0x150 [kvm] [ 218.733353] RSP: 0018:ffff88001f9cbdf0 EFLAGS: 00010246 [ 218.733354] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000100000000 [ 218.733355] RDX: ffff88000da65000 RSI: ffff88001f9cbe30 RDI: ffff88000ea18100 [ 218.733356] RBP: ffff88000ea18100 R08: 0000000000000000 R09: 0000000000000000 [ 218.733357] R10: 0000000000000000 R11: 0000000000000203 R12: 000000008004ae98 [ 218.733358] R13: 0000000020007000 R14: ffff88000d48bb00 R15: 0000000020007000 [ 218.733362] FS: 00007fb33aba2700(0000) GS:ffff88000f900000(0000) knlGS:0000000000000000 [ 218.733363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 218.733365] CR2: 00000000000000f0 CR3: 000000000f7bb000 CR4: 00000000000006e0 [ 218.733369] Stack: [ 218.733372] ffff88000ea18100 00000000a9f3a679 ffff88000ea18100 ffff88001f9cbe30 [ 218.733374] ffffffffa0240172 ffffffffffffffea ffff88000ea18100 ffffffffa022c63c [ 218.733376] ffff88000ea14000 ffffffff8121705b ffff88000ea14000 ffff88000ea14a30 [ 218.733377] Call Trace: [ 218.733396] [<ffffffffa0240172>] ? kvm_arch_vcpu_ioctl_get_mpstate+0x12/0x40 [kvm] [ 218.733410] [<ffffffffa022c63c>] ? kvm_vcpu_ioctl+0xfc/0x5a0 [kvm] [ 218.733414] [<ffffffff8121705b>] ? anon_inode_getfd+0x4b/0x70 [ 218.733427] [<ffffffffa022b70f>] ? kvm_dev_ioctl+0x11f/0x450 [kvm] [ 218.733432] [<ffffffff811e3255>] ? do_vfs_ioctl+0x2d5/0x4b0 [ 218.733435] [<ffffffff811e34a6>] ? SyS_ioctl+0x76/0x90 [ 218.733439] [<ffffffff8158a3f6>] ? system_call_fast_compare_end+0xc/0x6b [ 218.733460] Code: 00 66 66 66 66 90 55 53 48 89 fd 48 83 ec 10 48 8b 9f a0 02 00 00 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 66 66 66 66 90 <48> 83 bb f0 00 00 00 00 75 22 48 8b 44 24 08 65 48 33 04 25 28 -- Robert Święcki
